Excessive Heap Allocation Vulnerability in HAPI FHIR Java Implementation
CVE-2026-81875
7.5HIGH
What is CVE-2026-81875?
The HAPI FHIR implementation of the HL7 FHIR standard for healthcare interoperability in Java contains a vulnerability in the SHCParser component. Preceding version 6.9.12, SHCParser can be exploited through specially crafted Smart Health Card JWTs, which may include an oversized payload causing excessive memory allocation during decompression. The logic in SHCParser.decodeJWT() and SHCParser.decompress() lacks bounds on output size, leading to potential process instability, excessive garbage collection pressure, or outright termination of application services. It is advised that users upgrade to version 6.9.12 or later to mitigate this vulnerability.
Affected Version(s)
org.hl7.fhir.core < 6.9.12